MALICIOUS — ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe

MALICIOUS — ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the MalwareHash family. 6 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
• SHA-1: 5ff465afaabcbf0150d1a3ab2c2e74f3a4426467
• MD5: 84c82835a5d21bbcf75a61706d8ab549
• imphash: 68f013d7437aa653a8a98a05807afeb1
• ssdeep: 98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3x:QqPe1Cxcxk3ZAEUadzR8yc4gB
• TLSH: T1B26033E75AB930C2E648DFF06881B8EF0914C41AB536754FBC10BB957ED403B42E58A6
• Submitted as: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
• File type: pe · Size: 3514368 bytes
• Verdict: malicious (99/100) · Family: MalwareHash

Detections (6 of 56 engines)

• ClamAV feed: SaneSecurity foxhole_generic: Sanesecurity.MalwareHash.WannaCry.UNOFFICIAL
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Microsoft Defender: Ransom:Win32/WannaCrypt!pz
• Emsisoft (Emergency Kit): Exploit.CVE-2017-0147.13
• Trellix Stinger (McAfee): Ransom-O.g
• Kaspersky (KVRT): Trojan-Ransom.Win32.Wanna.zbu

MITRE ATT&CK

• T1486

Why this verdict

The malicious score of 99/100 is the fusion of 7 weighted signals:

• ClamAV feed: SaneSecurity foxhole_generic flagged Sanesecurity.MalwareHash.WannaCry.UNOFFICIAL (rule Sanesecurity.MalwareHash.WannaCry.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Ransom:Win32/WannaCrypt!pz (rule Ransom:Win32/WannaCrypt!pz) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Exploit.CVE-2017-0147.13 (rule Exploit.CVE-2017-0147.13) - engine signal, weight 0.55, confidence 0.85
• Trellix Stinger (McAfee) flagged Ransom-O.g (rule Ransom-O.g) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged Trojan-Ransom.Win32.Wanna.zbu (rule Trojan-Ransom.Win32.Wanna.zbu) - engine signal, weight 0.55, confidence 0.85
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
• encrypt data (rule encrypt data) - capa signal, weight 0.15, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded domains

• t.ua
• y.ga

File paths

• d:\5
• V:\Ge
• g:\zX

More MalwareHash samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report